72 lines
2.0 KiB
Go
72 lines
2.0 KiB
Go
// Package auth 管理端 JWT：签发与校验，使用 Authorization: Bearer <token>
|
||
package auth
|
||
|
||
import (
|
||
"net/http"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/golang-jwt/jwt/v5"
|
||
)
|
||
|
||
const adminJWTExpire = 7 * 24 * time.Hour // 7 天
|
||
|
||
// AdminClaims 管理端 JWT 载荷
|
||
type AdminClaims struct {
|
||
jwt.RegisteredClaims
|
||
Username string `json:"username"`
|
||
Role string `json:"role"`
|
||
}
|
||
|
||
// IssueAdminJWT 签发管理端 JWT，使用 ADMIN_SESSION_SECRET 签名（role 为空时默认 admin）
|
||
func IssueAdminJWT(secret, username, role string) (string, error) {
|
||
if role == "" {
|
||
role = "admin"
|
||
}
|
||
now := time.Now()
|
||
claims := AdminClaims{
|
||
RegisteredClaims: jwt.RegisteredClaims{
|
||
ExpiresAt: jwt.NewNumericDate(now.Add(adminJWTExpire)),
|
||
IssuedAt: jwt.NewNumericDate(now),
|
||
Subject: "admin",
|
||
},
|
||
Username: username,
|
||
Role: role,
|
||
}
|
||
tok := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
||
return tok.SignedString([]byte(secret))
|
||
}
|
||
|
||
// ParseAdminJWT 校验并解析 JWT，返回 claims；无效或过期返回 nil, false
|
||
func ParseAdminJWT(tokenString, secret string) (*AdminClaims, bool) {
|
||
if tokenString == "" || secret == "" {
|
||
return nil, false
|
||
}
|
||
tok, err := jwt.ParseWithClaims(tokenString, &AdminClaims{}, func(t *jwt.Token) (interface{}, error) {
|
||
return []byte(secret), nil
|
||
}, jwt.WithValidMethods([]string{"HS256"}))
|
||
if err != nil || !tok.Valid {
|
||
return nil, false
|
||
}
|
||
claims, ok := tok.Claims.(*AdminClaims)
|
||
if !ok || claims.Username == "" {
|
||
return nil, false
|
||
}
|
||
return claims, true
|
||
}
|
||
|
||
// GetAdminJWTFromRequest 从请求中读取 JWT：优先 Authorization: Bearer <token>，其次 Cookie admin_session（兼容旧端）
|
||
func GetAdminJWTFromRequest(r *http.Request) string {
|
||
// 1. Authorization: Bearer <token>
|
||
ah := r.Header.Get("Authorization")
|
||
if strings.HasPrefix(ah, "Bearer ") {
|
||
return strings.TrimSpace(ah[7:])
|
||
}
|
||
// 2. Cookie（兼容：若值为 JWT 格式则可用）
|
||
c, err := r.Cookie(adminCookieName)
|
||
if err != nil || c == nil {
|
||
return ""
|
||
}
|
||
return strings.TrimSpace(c.Value)
|
||
}
|